plugin-scanner 2.0.804__tar.gz → 2.0.806__tar.gz

{plugin_scanner-2.0.804 → plugin_scanner-2.0.806}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.804
+Version: 2.0.806
 Summary: Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.804 → plugin_scanner-2.0.806}/dashboard/src/policy-active-mode-card.tsx

@@ -1,6 +1,7 @@
 import { HiMiniShieldCheck } from "react-icons/hi2";
 import { SectionLabel } from "./approval-center-primitives";
 import type { GuardRuntimeSnapshot } from "./guard-types";
+import { POLICY_SUMMARY_CARD_CLASS } from "./policy-summary-surfaces";
 import { resolveSecurityModeCopy } from "./policy-workspace-helpers";
 
 type PolicyActiveModeCardProps = {
@@ -11,15 +12,15 @@ export function PolicyActiveModeCard({ snapshot }: PolicyActiveModeCardProps) {
   const modeCopy = resolveSecurityModeCopy(snapshot.security_level);
 
   return (
-    <div className="rounded-2xl border border-slate-200/70 bg-white p-4 shadow-sm">
+    <div className={`${POLICY_SUMMARY_CARD_CLASS} self-start p-4`}>
       <SectionLabel>Active mode</SectionLabel>
-      <div className="mt-3 flex items-start gap-3">
-        <span className="flex h-10 w-10 shrink-0 items-center justify-center rounded-xl bg-brand-blue/10 text-brand-blue">
-          <HiMiniShieldCheck className="h-5 w-5" aria-hidden="true" />
+      <div className="mt-2 flex items-start gap-2.5">
+        <span className="flex h-9 w-9 shrink-0 items-center justify-center rounded-xl bg-brand-blue/10 text-brand-blue">
+          <HiMiniShieldCheck className="h-4 w-4" aria-hidden="true" />
         </span>
         <div className="min-w-0">
           <p className="text-sm font-semibold text-brand-dark">{modeCopy.label}</p>
-          <p className="mt-1 text-sm leading-relaxed text-slate-600">{modeCopy.description}</p>
+          <p className="mt-0.5 line-clamp-3 text-sm leading-snug text-slate-600">{modeCopy.description}</p>
         </div>
       </div>
     </div>

{plugin_scanner-2.0.804 → plugin_scanner-2.0.806}/dashboard/src/policy-guard-cloud-bundle-card.test.ts

@@ -11,7 +11,7 @@ function assert(condition: boolean, message: string): void {
 }
 
 assert(
-  formatCloudBundleHashDisplay("sha256:abcdef1234567890") === "sha256:abcd…",
+  formatCloudBundleHashDisplay("sha256:abcdef1234567890") === "sha256:abcdef12…",
   "bundle hash display truncates sha256 hashes",
 );
 assert(
@@ -27,7 +27,7 @@ const attentionCopy = resolveCloudPolicyBundleCopy({
 });
 assert(attentionCopy?.label === "Needs attention", "sync error surfaces attention label");
 assert(
-  resolveCloudBundleStatusSubtitle(attentionCopy!) === "Latest sync needs attention",
+  resolveCloudBundleStatusSubtitle(attentionCopy!) === "Sync needs attention",
   "status subtitle stays short when sync needs attention",
 );
 assert(

plugin_scanner-2.0.806/dashboard/src/policy-guard-cloud-bundle-card.tsx

@@ -0,0 +1,146 @@
+import { useCallback } from "react";
+import { HiMiniCheckCircle, HiMiniClipboardDocument, HiMiniCloudArrowUp } from "react-icons/hi2";
+import { ActionButton, SectionLabel, Tag } from "./approval-center-primitives";
+import { formatRelativeTime } from "./approval-center-utils";
+import type { GuardRuntimeSnapshot } from "./guard-types";
+import {
+  formatCloudBundleHashDisplay,
+  resolveCloudBundleStatusSubtitle,
+} from "./policy-guard-cloud-bundle-helpers";
+import { POLICY_SUMMARY_CARD_CLASS } from "./policy-summary-surfaces";
+import {
+  resolveCloudPolicyBundleCopy,
+  resolveCloudExceptionsConnected,
+  resolveCloudPolicyControlsUrl,
+} from "./policy-workspace-helpers";
+
+type PolicyGuardCloudBundleCardProps = {
+  snapshot: GuardRuntimeSnapshot;
+};
+
+function CloudBundleHeader({
+  cloudControlsUrl,
+}: {
+  cloudControlsUrl: string | null;
+}) {
+  return (
+    <div className="flex flex-wrap items-center justify-between gap-2">
+      <SectionLabel>Guard Cloud bundle</SectionLabel>
+      {cloudControlsUrl ? (
+        <ActionButton href={cloudControlsUrl} variant="secondary">
+          <HiMiniCloudArrowUp className="mr-1.5 h-4 w-4" aria-hidden="true" />
+          Open Guard Cloud
+        </ActionButton>
+      ) : null}
+    </div>
+  );
+}
+
+export function PolicyGuardCloudBundleCard({ snapshot }: PolicyGuardCloudBundleCardProps) {
+  const cloudBundleCopy = resolveCloudPolicyBundleCopy(snapshot);
+  const cloudControlsUrl = resolveCloudPolicyControlsUrl(snapshot);
+  const cloudConnected = resolveCloudExceptionsConnected(snapshot);
+  const lastAckAt =
+    snapshot.cloud_policy_last_ack_at?.trim() ??
+    snapshot.runtime_state?.last_heartbeat_at?.trim() ??
+    snapshot.generated_at?.trim() ??
+    null;
+  const policyHash = cloudBundleCopy?.hash?.trim() ?? null;
+  const policyHashDisplay = formatCloudBundleHashDisplay(policyHash);
+  const bundleVersion = snapshot.cloud_policy_bundle_version?.trim() ?? null;
+
+  const handleCopyHash = useCallback(() => {
+    if (!policyHash || !navigator.clipboard?.writeText) {
+      return;
+    }
+    void navigator.clipboard.writeText(policyHash);
+  }, [policyHash]);
+
+  if (!cloudBundleCopy) {
+    return (
+      <div className={`${POLICY_SUMMARY_CARD_CLASS} self-start p-4`}>
+        <CloudBundleHeader cloudControlsUrl={cloudControlsUrl} />
+        {cloudConnected ? (
+          <>
+            <p className="mt-2 text-sm font-medium text-brand-dark">
+              {snapshot.cloud_state_label?.trim() || "Connected to Guard Cloud"}
+            </p>
+            <p className="mt-1 text-sm leading-relaxed text-brand-dark/75">
+              {snapshot.cloud_state_detail?.trim() ||
+                "Guard Cloud is connected. Policy bundle details will appear after the next successful sync."}
+            </p>
+          </>
+        ) : (
+          <p className="mt-2 text-sm leading-relaxed text-brand-dark/75">
+            Guard Cloud is not connected. Remembered Cloud rules appear when Guard Cloud syncs a bundle.
+          </p>
+        )}
+      </div>
+    );
+  }
+
+  const synced = cloudBundleCopy.tone === "green";
+  const statusSubtitle = resolveCloudBundleStatusSubtitle(cloudBundleCopy);
+  const showDetail = !synced;
+
+  return (
+    <div className={`${POLICY_SUMMARY_CARD_CLASS} self-start p-4`}>
+      <CloudBundleHeader cloudControlsUrl={cloudControlsUrl} />
+
+      <dl className="mt-3 grid grid-cols-3 gap-x-3 gap-y-1">
+        <div className="min-w-0">
+          <dt className="text-[10px] font-semibold uppercase tracking-wider text-slate-500">Status</dt>
+          <dd className="mt-1 flex min-w-0 items-center gap-1">
+            {synced ? (
+              <HiMiniCheckCircle className="h-3.5 w-3.5 shrink-0 text-emerald-600" aria-hidden="true" />
+            ) : null}
+            <Tag tone={synced ? "green" : "amber"}>{synced ? "Synced" : cloudBundleCopy.label}</Tag>
+          </dd>
+        </div>
+
+        <div className="min-w-0">
+          <dt className="text-[10px] font-semibold uppercase tracking-wider text-slate-500">Bundle hash</dt>
+          <dd className="mt-1 flex min-w-0 items-center gap-1">
+            <span className="truncate font-mono text-sm text-brand-dark" title={policyHash ?? undefined}>
+              {policyHashDisplay}
+            </span>
+            {policyHash ? (
+              <button
+                type="button"
+                onClick={handleCopyHash}
+                className="shrink-0 rounded-md p-0.5 text-slate-400 hover:bg-slate-100 hover:text-brand-dark"
+                aria-label="Copy bundle hash"
+              >
+                <HiMiniClipboardDocument className="h-3.5 w-3.5" aria-hidden="true" />
+              </button>
+            ) : null}
+          </dd>
+        </div>
+
+        <div className="min-w-0">
+          <dt className="text-[10px] font-semibold uppercase tracking-wider text-slate-500">Last ack</dt>
+          <dd className="mt-1 min-w-0">
+            <p className="truncate text-sm text-brand-dark">
+              {lastAckAt ? formatRelativeTime(lastAckAt) : "Not yet"}
+            </p>
+            {bundleVersion ? (
+              <p className="truncate text-xs text-slate-500" title={bundleVersion}>
+                {bundleVersion}
+              </p>
+            ) : null}
+          </dd>
+        </div>
+      </dl>
+
+      {synced ? (
+        <p className="mt-2 truncate text-xs text-slate-500">{statusSubtitle}</p>
+      ) : null}
+
+      {showDetail ? (
+        <p className="mt-3 rounded-xl border border-amber-200/80 bg-amber-50/60 px-3 py-2 text-sm leading-snug text-slate-700">
+          {cloudBundleCopy.detail}
+        </p>
+      ) : null}
+    </div>
+  );
+}

{plugin_scanner-2.0.804 → plugin_scanner-2.0.806}/dashboard/src/policy-guard-cloud-bundle-helpers.ts

@@ -7,9 +7,9 @@ export function formatCloudBundleHashDisplay(hash: string | null | undefined): s
   const normalized = isSha256 ? value.slice(7) : value;
 
   if (isSha256) {
-    return normalized.length <= 4 ? value : `sha256:${normalized.slice(0, 4)}…`;
+    return normalized.length <= 8 ? value : `sha256:${normalized.slice(0, 8)}…`;
   }
-  return normalized.length <= 8 ? normalized : `${normalized.slice(0, 8)}…`;
+  return normalized.length <= 12 ? normalized : `${normalized.slice(0, 12)}…`;
 }
 
 export function resolveCloudBundleStatusSubtitle(copy: {
@@ -21,7 +21,7 @@ export function resolveCloudBundleStatusSubtitle(copy: {
     return "All policies up to date";
   }
   if (copy.tone === "attention") {
-    return "Latest sync needs attention";
+    return "Sync needs attention";
   }
   return copy.label;
 }

{plugin_scanner-2.0.804 → plugin_scanner-2.0.806}/dashboard/src/policy-remembered-rules-tab.tsx

@@ -139,7 +139,7 @@ export function PolicyRememberedRulesTab({
   return (
     <div className="grid gap-4 lg:grid-cols-[minmax(0,1fr)_280px] lg:items-start">
       <div className="space-y-4">
-        <div className="grid gap-4 lg:grid-cols-2">
+        <div className="grid gap-4 lg:grid-cols-[minmax(0,1.35fr)_minmax(0,1fr)] lg:items-start">
           <PolicyGuardCloudBundleCard snapshot={snapshot} />
           <PolicyActiveModeCard snapshot={snapshot} />
         </div>

plugin_scanner-2.0.806/dashboard/src/policy-summary-surfaces.ts

@@ -0,0 +1,2 @@
+export const POLICY_SUMMARY_CARD_CLASS =
+  "rounded-2xl border border-slate-200/80 bg-white shadow-[0_1px_2px_rgba(15,23,42,0.04),0_8px_20px_rgba(15,23,42,0.04)]";

{plugin_scanner-2.0.804 → plugin_scanner-2.0.806}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.804"
+version = "2.0.806"
 description = "Lint, verify, and gate plugin ecosystems for maintainers, CI, and publish workflows."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.804 → plugin_scanner-2.0.806}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.804"
+version = "2.0.806"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, and OpenCode."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.804 → plugin_scanner-2.0.806}/src/codex_plugin_scanner/guard/approvals.py

@@ -39,7 +39,7 @@ from .models import (
     PolicyDecision,
 )
 from .risk import artifact_risk_signals, artifact_risk_summary
-from .store import GuardStore, _runtime_scoped_exact_match_key
+from .store import GuardStore, _runtime_scoped_exact_match_key, runtime_tool_action_exact_match_context
 
 GUARD_COMMAND = "hol-guard"
 GUARD_DASHBOARD_URL = "https://hol.org/guard"
@@ -463,7 +463,23 @@ def _artifact_scope_runtime_exact_match_key(request: Mapping[str, object], scope
     if scope != "artifact" or request.get("artifact_type") != "tool_action_request":
         return None
     artifact_id = request.get("artifact_id")
-    return _runtime_scoped_exact_match_key(artifact_id) if isinstance(artifact_id, str) else None
+    raw_command_text = _string_or_none(request.get("raw_command_text"))
+    wrapper_chain = request.get("wrapper_chain")
+    envelope = request.get("action_envelope_json")
+    if isinstance(envelope, Mapping):
+        raw_command_text = raw_command_text or _string_or_none(envelope.get("raw_command_text"))
+        if not isinstance(wrapper_chain, Sequence) or isinstance(wrapper_chain, str):
+            wrapper_chain = envelope.get("wrapper_chain")
+    normalized_wrapper_chain = (
+        wrapper_chain if isinstance(wrapper_chain, Sequence) and not isinstance(wrapper_chain, str) else None
+    )
+    context = runtime_tool_action_exact_match_context(
+        config_path=_string_or_none(request.get("config_path")),
+        source_scope=_string_or_none(request.get("source_scope")),
+        raw_command_text=raw_command_text,
+        wrapper_chain=normalized_wrapper_chain,
+    )
+    return _runtime_scoped_exact_match_key(artifact_id, context) if isinstance(artifact_id, str) else None
 
 
 def _broad_runtime_exact_match_key(request: Mapping[str, object], scope: str) -> str | None:

{plugin_scanner-2.0.804 → plugin_scanner-2.0.806}/src/codex_plugin_scanner/guard/cli/commands_support_claude_approval.py

@@ -58,10 +58,21 @@ def _persist_claude_pending_permission_denials(store: GuardStore, payload: dict[
         if artifact_id is None or artifact_hash_value is None:
             continue
         reason = _optional_string(pending.get("reason")) or "Denied in Claude's native approval prompt."
+        artifact_type = _optional_string(pending.get("artifact_type"))
+        config_path = _optional_string(pending.get("config_path"))
+        source_scope = _optional_string(pending.get("source_scope"))
+        raw_command_text = _optional_string(pending.get("raw_command_text"))
+        pending_wrapper_chain = pending.get("wrapper_chain")
+        wrapper_chain = pending_wrapper_chain if isinstance(pending_wrapper_chain, list) else None
         saved_policy = _persist_claude_native_permission_policy(
             store=store,
             artifact_id=artifact_id,
             artifact_hash=artifact_hash_value,
+            artifact_type=artifact_type,
+            config_path=config_path,
+            source_scope=source_scope,
+            raw_command_text=raw_command_text,
+            wrapper_chain=wrapper_chain,
             action="block",
             reason=f"Denied in Claude native approval prompt. {reason}",
             now=_now(),
@@ -316,11 +327,20 @@ def _persist_claude_guard_question_decision(store: GuardStore, payload: dict[str
     if artifact_id is None or artifact_hash_value is None:
         return False
     artifact_type = _optional_string(pending.get("artifact_type"))
+    config_path = _optional_string(pending.get("config_path"))
+    source_scope = _optional_string(pending.get("source_scope"))
+    raw_command_text = _optional_string(pending.get("raw_command_text"))
+    pending_wrapper_chain = pending.get("wrapper_chain")
+    wrapper_chain = pending_wrapper_chain if isinstance(pending_wrapper_chain, list) else None
     saved = _persist_claude_native_permission_policy(
         store=store,
         artifact_id=artifact_id,
         artifact_hash=artifact_hash_value,
         artifact_type=artifact_type,
+        config_path=config_path,
+        source_scope=source_scope,
+        raw_command_text=raw_command_text,
+        wrapper_chain=wrapper_chain,
         action=action,
         reason=(
             "Allowed through HOL Guard AskUserQuestion approval."

{plugin_scanner-2.0.804 → plugin_scanner-2.0.806}/src/codex_plugin_scanner/guard/cli/commands_support_hook_state.py

@@ -168,6 +168,12 @@ def _record_claude_permission_notice(
         "approval_options": list(_CLAUDE_GUARD_APPROVAL_OPTIONS),
         "approval_code": approval_code,
     }
+    raw_command_text = artifact.metadata.get("raw_command_text")
+    if isinstance(raw_command_text, str) and raw_command_text:
+        notice_payload["raw_command_text"] = raw_command_text
+    wrapper_chain = artifact.metadata.get("wrapper_chain")
+    if isinstance(wrapper_chain, list):
+        notice_payload["wrapper_chain"] = [item for item in wrapper_chain if isinstance(item, str) and item]
     if tool_name is not None:
         notice_payload["tool_name"] = tool_name
     try:

{plugin_scanner-2.0.804 → plugin_scanner-2.0.806}/src/codex_plugin_scanner/guard/cli/commands_support_permission_store.py

@@ -4,6 +4,7 @@
 
 from __future__ import annotations
 
+from collections.abc import Sequence
 from typing import TYPE_CHECKING
 
 if TYPE_CHECKING:
@@ -29,7 +30,7 @@ if TYPE_CHECKING:
     from .commands_support_runtime_resolution import _runtime_capabilities_summary
 
 
-from ..store import _runtime_scoped_exact_match_key
+from ..store import _runtime_scoped_exact_match_key, runtime_tool_action_exact_match_context
 from ._commands_shared import *
 from .commands_parser_helpers import *
 
@@ -416,13 +417,29 @@ def _persist_claude_native_permission_policy(
     artifact_id: str,
     artifact_hash: str,
     artifact_type: str | None = None,
+    config_path: str | None = None,
+    source_scope: str | None = None,
+    raw_command_text: str | None = None,
+    wrapper_chain: Sequence[object] | None = None,
     action: str,
     reason: str,
     now: str,
     source: str = "claude-native-approval",
 ) -> bool:
+    exact_match_context = (
+        runtime_tool_action_exact_match_context(
+            config_path=config_path,
+            source_scope=source_scope,
+            raw_command_text=raw_command_text,
+            wrapper_chain=wrapper_chain,
+        )
+        if artifact_type == "tool_action_request"
+        else None
+    )
     exact_artifact_hash = (
-        _runtime_scoped_exact_match_key(artifact_id) if artifact_type == "tool_action_request" else None
+        _runtime_scoped_exact_match_key(artifact_id, exact_match_context)
+        if artifact_type == "tool_action_request"
+        else None
     )
     stored_artifact_hash = exact_artifact_hash or artifact_hash
     try:
@@ -476,11 +493,23 @@ def _persist_claude_native_permission_for_runtime_artifact(
     if pending is None:
         return False
     now = _now()
+    raw_command_text_value = artifact.metadata.get("raw_command_text")
+    raw_command_text = raw_command_text_value if isinstance(raw_command_text_value, str) else None
+    wrapper_chain_value = artifact.metadata.get("wrapper_chain")
+    wrapper_chain = (
+        wrapper_chain_value
+        if isinstance(wrapper_chain_value, Sequence) and not isinstance(wrapper_chain_value, str)
+        else None
+    )
     saved_policy = _persist_claude_native_permission_policy(
         store=store,
         artifact_id=artifact.artifact_id,
         artifact_hash=artifact_hash,
         artifact_type=artifact.artifact_type,
+        config_path=artifact.config_path,
+        source_scope=artifact.source_scope,
+        raw_command_text=raw_command_text,
+        wrapper_chain=wrapper_chain,
         action=action,
         reason=reason,
         now=now,

{plugin_scanner-2.0.804 → plugin_scanner-2.0.806}/src/codex_plugin_scanner/guard/cli/commands_support_runtime_policy.py

@@ -6,6 +6,7 @@
 from __future__ import annotations
 
 import importlib
+from collections.abc import Sequence
 from typing import TYPE_CHECKING
 
 if TYPE_CHECKING:
@@ -13,7 +14,7 @@ if TYPE_CHECKING:
     from .commands_support_prompts import _prompt_request_classes, _prompt_requires_hard_block
 
 
-from ..store import _runtime_scoped_exact_match_key
+from ..store import _runtime_scoped_exact_match_key, runtime_tool_action_exact_match_context
 from ._commands_shared import *
 from .commands_parser_helpers import *
 
@@ -228,13 +229,25 @@ def _runtime_stored_policy_action(
     artifact_hash: str,
     workspace: str | None,
 ) -> str | None:
+    runtime_exact_match_context = _runtime_artifact_exact_match_context(artifact)
     decision = store.resolve_policy_decision(
         harness,
         artifact_id,
         artifact_hash,
         workspace,
         artifact.publisher,
+        runtime_exact_match_context=runtime_exact_match_context,
     )
+    if decision is None and runtime_exact_match_context is not None:
+        legacy_decision = store.resolve_policy_decision(
+            harness,
+            artifact_id,
+            artifact_hash,
+            workspace,
+            artifact.publisher,
+        )
+        if _optional_string((legacy_decision or {}).get("scope")) in {"harness", "global"}:
+            decision = legacy_decision
     if decision is None:
         return None
     action = _optional_string(decision.get("action"))
@@ -256,12 +269,35 @@ def _runtime_stored_policy_action(
             return None
         if scope in {"harness", "global"}:
             decision_artifact_hash = _optional_string(decision.get("artifact_hash"))
-            exact_match_key = _runtime_scoped_exact_match_key(artifact_id)
-            if exact_match_key is None:
+            exact_match_keys = {
+                key
+                for key in (
+                    _runtime_scoped_exact_match_key(artifact_id),
+                    _runtime_scoped_exact_match_key(artifact_id, runtime_exact_match_context),
+                )
+                if key is not None
+            }
+            if not exact_match_keys:
                 return action if decision_artifact_id is not None else None
-            return action if decision_artifact_hash == exact_match_key else None
+            return action if decision_artifact_hash in exact_match_keys else None
         return None
     return action
+
+
+def _runtime_artifact_exact_match_context(artifact: GuardArtifact) -> str | None:
+    if artifact.artifact_type != "tool_action_request":
+        return None
+    raw_command_text = artifact.metadata.get("raw_command_text")
+    wrapper_chain = artifact.metadata.get("wrapper_chain")
+    normalized_wrapper_chain = (
+        wrapper_chain if isinstance(wrapper_chain, Sequence) and not isinstance(wrapper_chain, str) else None
+    )
+    return runtime_tool_action_exact_match_context(
+        config_path=artifact.config_path,
+        source_scope=artifact.source_scope,
+        raw_command_text=raw_command_text if isinstance(raw_command_text, str) else None,
+        wrapper_chain=normalized_wrapper_chain,
+    )
 def _runtime_artifact_policy_action(config: GuardConfig, artifact: GuardArtifact, harness: str) -> str:
     if _prompt_requires_hard_block(artifact):
         return "block"